CORS handling is delegated to 'cors' module